Privacy Policy

Last updated: 15 October 2026

1. Who we are

This policy covers Zordical (zordical.com), its dashboards, its WhatsApp assistant, and the ordering, loyalty and website pages it creates for each business. "We" and "us" means Zordical. "Café" means any business that has an account with us. "Customers" means the people who interact with a café through Zordical.

2. Information we collect

From café owners and staff

• Account details: name, mobile number, email (if given), business name, address, opening hours and settings.
• Login details. Passwords are stored only as secure hashes.
• Business content you add: menu, prices, photos, offers, and the facts you teach the AI assistant.
• Billing records: plan, amount, dates and payment reference. Card and UPI details are handled by Razorpay. We never see or store them.

From a café's customers (on the café's behalf)

• Name and mobile or WhatsApp number.
• Messages sent to the café's WhatsApp number, and the replies.
• Orders, table reservations, delivery address (for delivery orders), feedback and ratings.
• Loyalty points, visits, coupons and, if given, birthday.

From Google, if a café connects its Google Business Profile

• The business profile (name, category, address, hours, description), its reviews and replies, its posts, and its performance numbers (for example views, calls and direction requests).
• The Google account email used to connect, and access tokens, which are stored encrypted.

Automatically

• Basic server logs (time, page or action, IP address) used for security and fixing problems.
• Your browser keeps your login session in local storage. We use no advertising or analytics trackers.

3. How we use information

• To run the service: reply to customers on WhatsApp, take orders and bookings, run loyalty, send the messages a café approves, and show the café its dashboard.
• To alert café owners to things that need attention, such as a complaint or a low Google rating.
• To bill for plans, provide support, keep the service secure and fix problems.
• To improve Zordical using aggregated information that doesn't identify anyone.

We never sell personal data, and we never use it for advertising.

4. AI processing

To write replies and drafts, we send the text needed for that task to an AI provider: for example a customer's message plus the café's menu and facts, or a review's text. Today that is Anthropic (Claude), with Google (Gemini) as a backup. They process it under their own API terms. AI replies can be wrong. Cafés can see conversations, and nothing is posted to Google without a person approving it.

5. Who we share information with

Only the service providers needed to run Zordical:

• Amazon Web Services: our servers and backups.
• WhatsApp (Meta): to deliver messages between a café and its customers.
• Anthropic and Google: AI processing, as described above.
• Razorpay: subscription and order payments.
• Google: only if a café connects its Business Profile, to read and publish the content the café approves.

We may also disclose information when the law requires it, or to protect people or the service from fraud or abuse.

6. Google user data

Zordical's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to show it to the café in its dashboard, to draft review replies and posts, and to publish what the café approves. It is not used for advertising, not sold, and not used to train general AI models. A café can disconnect at any time from Settings, or by removing Zordical's access in its Google account permissions. Disconnecting deletes our stored Google tokens.

7. Cafés and their customers

For customer data, the café decides why and how it is used. Under India's Digital Personal Data Protection Act, 2023, the café is the Data Fiduciary and Zordical is its Data Processor. Each café is responsible for telling its customers how their data is used and for getting any consent needed, especially before sending marketing messages. If you are a café's customer, contact the café first. We will help it answer your request.

8. How long we keep information

• We keep a café's data while its account is open.
• When a café closes its account and asks, we delete its data and its customers' data within 90 days. Records the law requires us to keep, such as billing records, are the exception.
• Backups are removed on their normal rotation.
• Server logs are kept only as long as needed for security and troubleshooting.

9. Security

We use HTTPS everywhere. Passwords are hashed and Google access tokens are encrypted. Every café's data is separated from every other café's. Staff permissions limit who can change settings. No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

10. Your rights

Under the Digital Personal Data Protection Act, 2023, you can ask us to:

• see the personal data we hold about you
• correct it
• delete it
• withdraw consent
• nominate someone to act for you

You can also raise a grievance with us. We reply within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

11. Children

Zordical is for businesses and is not directed at children. Café accounts must be opened by adults.

12. Changes to this policy

We will post any change here and update the date at the top. If a change is significant, we will tell café owners on WhatsApp or in the dashboard.

13. Contact and grievances

For privacy questions, data requests or grievances, message or call us on WhatsApp at +91 80042 84193.